The federal Transportation Security Administration (TSA) yesterday proposed a rule that would mandate some surface transportation owners and operators, including those running pipelines and railroads, to meet certain cyber risk management and reporting requirements.
The new rule would require:
- Owner/operators of pipelines and/or railroads that have a higher cybersecurity risk profiles to establish and maintain a comprehensive cyber risk management program;
- Owner/operators that are currently required to report significant physical security concerns to TSA to also report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency; and
- Higher-risk pipeline owner/operators to designate a physical security coordinator and report significant physical security concerns to TSA.
By publishing a “notice of proposed rulemaking” in the Federal Register, Federal Register, which is the daily journal of the U.S. government, TSA has initiated a 60-day period for public comment from any interested party and an additional 30 days for reply comments.
"TSA has collaborated closely with its industry partners to increase the cybersecurity resilience of the nation's critical transportation infrastructure," TSA Administrator David Pekoske said in a release. "The requirements in the proposed rule seek to build on this collaborative effort and further strengthen the cybersecurity posture of surface transportation stakeholders. We look forward to industry and public input on this proposed regulation."
The notice came a week after a White House representative warned the trucking freight industry that the People’s Republic of China (PRC) has remained the most active and persistent cyber threat to the U.S. government, private sector, and critical infrastructure networks. The briefing came from a member of the administration’s Office of the National Cyber Director, in an address to attendees at the National Motor Freight Traffic Association (NMFTA)’s Cybersecurity Conference.
“In January, the National Cyber Director testified in front of Congress along with colleagues from CISA, NSA, and the FBI about this threat from the PRC, dubbed Volt Typhoon,” speaker Stephen Viña said in his remarks. “Volt Typhoon conducted cyber operations focused not on financial gain, espionage, or state secrets but on developing deep access to our critical infrastructure. This includes the energy sector transportation systems, among many others. A prolonged interruption to these critical services could disrupt our ability to mobilize in the event of a national emergency or conflict and can create panic among our citizens. Ultimately, if trucking stops, America stops.”
